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21 January 2021 
Dear Chair, 


The Information Commissioner’s Office response to recommendations by 
the House of Lords Gambling Industry Select Committee in their Report 
on the Social and Economic Impact of the Gambling Industry 


I write in response to the Gambling Industry Committee’s report of July 2020 
titled ‘Gambling Harm - Time for Action’! in which the Committee makes a 
number of recommendations, some of which are directed at the Information 
Commissioner's Office (ICO). I would like to take this opportunity to advise you 
of our work in this area. 


Overview 


The Committee has recommended that the ICO work with the Gambling 
Commission, the Betting and Gaming Council and UK Finance, to resolve 
perceived data protection barriers to sharing personal data in order to protect 
customers from harm related to gambling. (See recommendations 30 and 33 of 
the Select Committee’s report). 


The Select Committee recommended an approach based on affordability — i.e. 
can the customer afford the amount of money they are spending when they 
gamble. With data protection considerations borne in mind, we can see the 
benefits of carrying out affordability checks both as part of the onboarding 
process when a customer opens a new account with an operator, and over the 
duration of that customer’s account activity with the operator. We are, of 
course, open to working with the relevant bodies in the development of a safe 
and secure method for the proposed data sharing. 


It is worth noting, however, that affordability checks are not the only solution 
that is being considered in relation to this issue. We have been made aware, in 


1 House of Lords Gambling Industry Committee report Gambling Harm — Time for Action: 
https://committees. parliament.uk/publications/1700/documents/16622/default 
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discussions with both the Gambling Commission and technology companies in the 
sector, that behavioural data is a better indicator of whether a customer is at risk 
of harm than affordability data alone. This is because, by the time affordability is 
an issue for a customer, the harm has already been done. Steps currently being 
considered by the sector aim to prevent harm by intervening early. 


Single Customer View (SCV) 


Currently, decisions on interventions to prevent harm to a customer are made 
unilaterally by operators, with no awareness of the customer’s behaviour on 
accounts they hold elsewhere, resulting in a limited understanding of whether a 
customer is at risk of harm or not. 


A solution has been suggested by the Gambling Commission in relation to its 
proposals for a Single Customer View (SCV). SCV proposes that standardised 
data points about a customer are collected by operators, measured against an 
industry-agreed standardised risk score, to produce an accurate, real time 
assessment of whether a customer is at risk of harm. This proposed approach 
would utilise data already routinely processed by operators when managing 
relationships with their online customers. 


The innovation within SCV is the intention to identify multiple accounts held by 
the same individual - across all operators - enabling the risk score to reflect a 
360 degree view of an individual’s activity. The Gambling Commission has made 
it very clear to the ICO in our discussions that the identification of multiple 
accounts is crucial to the prevention of harm related to gambling. Most 
customers hold five or more accounts with a range of operators, who base their 
decisions on a limited view of the customer’s account activity. A customer at a 
high level of risk may have an account restricted with one operator and another 
opened or raised to VIP status with another. This communication failure between 
operators regarding their customers currently has had tragic, even fatal 
outcomes, for customers, their families and their communities. 


All gambling operators routinely share their customers’ data to a third party to 
meet their anti-money-laundering and fraud prevention obligations. Data sharing 
to protect their customers from harm should therefore not be a lower priority, 
nor more controversial, than fraud prevention measures. 


An innovation of this nature merits careful consideration of data protection 


compliance and a public conversation regarding why the processing is being 
considered. The Gambling Commission has informed the ICO that the reasons 
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why these steps are being considered will be presented to the public. Their 
current consultation on affordability? is a part of this dialogue. 


GDPR and the DPA 2018 have been cited as the reason personal data cannot be 
shared for measures such as Single Customer View. As stated in the evidence? 
the ICO previously gave to the House of Lords Select Committee, this is not the 
case. Data protection law should not be considered a barrier to sharing, instead it 
Should be viewed as a framework of safeguards to ensure fair, lawful and 
proportionate data sharing. Data protection law should not, for example, be 
cited as a barrier to sharing when it is necessary to protect the vital interests of 
an individual. 


ICO work in this area 
Engagement with the Gambling Commission and others 


Since late 2019 the ICO has been in discussions with the Gambling Commission 
regarding the sharing of personal data to prevent harm from gambling. This 
includes a workshop given by the ICO at the Gambling Commission’s event in 
February 2020, which looked at the data protection considerations specific to the 
proposed Single Customer View. Gambling operators, technology companies and 
the Betting and Gaming Council attended this event. During the workshop, the 
ICO made a recommendation for an industry-agreed Code of Conduct to be 
developed if Single Customer View is to be deployed. The Code would be subject 
to an approval process by the ICO under the GDPR, an approach other sectors, 
including the direct marketing sector, are also pursuing. 


For the Code of Conduct we would recommend including an industry commitment 
to: 


e standardised data points which all operators can collect regardless of the 
size of operator, with the minimum amount of data collected to achieve the 
desired goal (but with sufficient detail to ensure customers at risk are not 
missed); 


e standardised risk scores to ensure a customer is handled consistently 
across all operators; 


ronal tion inder adena Saal: call-for-evidence - Remote customer interaction - Consultation and Call for Evidence 


3 https://committees. parliament.uk/writtenevidence/739/html/ - ICO submission 
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e standardised approach to interventions, whether by an operator or 
independent body, once a customer has been identified as at risk; 


e an agreed procedure for responding to customer complaints regarding the 
processing and when exercising their data protection rights such as the 
right of access. If GDPR Article 22 (automated decision-making) is 
engaged, operators will need to be able to explain their decisions to 
customers in sufficient detail. 


ICO Innovation Hub and Sandbox‘ addressing a key issue: lawful basis 
for sharing data between operators 


From the ICO’s discussions with stakeholders in the gambling sector, it is clear 
that the industry is divided on whether their current legislation and licensing 
codes provide a strong enough legal imperative to share customer data for SCV. 
The industry is uncertain regarding the appropriate lawful basis for sharing 
customer data between operators and whether the data should be considered 
special category data (requiring extra care for compliance). Whilst these issues 
remain, the industry is hesitant to develop or deploy SCV, despite the potential 
benefits SCV could give for meeting their social responsibility obligations under 
current gambling sector legislation and licensing codes. 


To resolve these issues, the ICO Innovation Hub has been in discussions with the 
Gambling Commission regarding how SCV would operate and the data sharing 
necessary for it to function. 


As a result of these discussions, the Gambling Commission has now made a 
successful application to the ICO Sandbox. Whilst the ICO Sandbox does not 
ensure or certify compliance regarding the deployment of a new technology, it 
provides expert regulatory advice for organisations, developers and innovators. 
The ICO has committed to support the Gambling Commission by undertaking a 
detailed consideration of lawful bases and data protection compliance for Single 
Customer View. A formal announcement? to this effect has been made today. 


The Age-Appropriate Design Code (AADC) 


Another important area in which the ICO is engaged with the gambling sector is 
our work on the AADC (also known as ‘The Children’s Code’). The Children’s 


* https://ico.org.uk/sandbox 


> https://i 


projects-to-protect-vulnerable-people/ 


orts-innovative-data-sharing- 
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Code has completed its Parliamentary passage and will come into full effect, 
following its one year transitional period, in September 2021. Our work has 
included discussions with the Advertising Standards Agency on steps to prevent 
gambling advertisements being viewable by children online and the role of 
children’s data. 


We will be considering the use of children’s data in ways which are detrimental to 
their wellbeing this year, which will include looking at standards for nudge 
techniques, age verification, and age-gating. 


Future ICO work in this area 
Proposed trials of SCV 


The ICO is aware that the Gambling Commission is keen for trials of SCV to take 
place and that a number of technology companies are keen to deliver potential 
solutions. The ICO Sandbox may be a helpful environment to support 
consideration of data protection risks and compliance questions as part of the 
early trials of SCV once technology provider/s have been selected. 


Data for research and insight into customer behaviour 


Throughout the Select Committee’s report, a lack of data for the scrutiny of 
independent researchers is highlighted (paragraph 598) - and the need for 
operators to better identify customers at risk of harm (recommendation 13). As 
previously stated, this data is already held by operators but is not readily shared. 
Those concerned about gambling-related harms argue that this lack of sharing 
hinders harm identification, insight into customer behaviour, research and 
ultimately the resourcing, allocation and effectiveness of treatment. Better 
channels for accessing data have the potential to redress this. 


Data from Single Customer View could be of central importance for longitudinal 
Studies (recommendations 19 and 20), to understand changes in customer 
behaviour, particularly where availability of data is limited, such as data 
regarding women who gamble and may be at risk of harm. 


A key area the industry is being called to address is the connection between 
problem gambling and the risk of suicide (recommendation 25). Data gathered 
on this topic may be highly subjective, based on user surveys, which carries the 
inherent risk of the lack of understanding an individual has about their own 
behaviour, limiting the usefulness for researchers. Objective data from Single 
Customer View could show the full extent of an individual's behaviour, giving 


21 January 2021 V1.0 5 


1CO. 


Information Commissioner’s Office 


operators (or an independent appointed body) the opportunity to intervene 
effectively. 


Any processing of personal data carries with it the responsibility to safeguard the 
rights and freedoms of individuals, balancing these rights with the need to 
protect individuals from the harm SCV hopes to prevent. Developers of SCV need 
to adopt a data protection by design and by default approach, as expressed in 
Article 25 of the GDPR. Any risks identified need to be addressed and mitigated 
so that the potential benefits of SCV can be realised without causing unintended 
harm. 


We intend to work with the sector and advise on the data protection implications 
of the various proposals and how these goals may be met in compliance with 
data protection law. 


Closing comments 


Single Customer View has the potential to be an effective data sharing method 
for gambling sector operators to protect their customers from harm, with 
procedures as standardised as those already in place for Anti-Money Laundering 
and fraud, if the standards of data protection compliance outlined in the GDPR 
and DPA 2018 are met. Insights gained from Single Customer View would be of 
particular interest to policymakers, independent researchers, psychologists and 
other clinicians, would aid the appropriate estimation and allocation of resources 
for treatment centres, and would contribute to the Government’s goal of making 
the UK the safest place in the world to be online. 


The ICO accepts the recommendations of the Committee and is working with the 
Gambling Commission and other appropriate bodies to address perceived barriers 
to sharing personal data in order to protect customers from harm related to 
gambling. 

Yours sincerely, 


Steve Wood 
Deputy Commissioner (Executive Director - Regulatory Strategy Service) 
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